Auditd shutdown

[Steve Grubb]

Hello,

Having the kernel detect a signal being sent to the audit daemon is not 
working. Is anyone troubleshooting this or do we take another approach?

I spent some time yesterday thinking about the shutdown. I came to the 
conclusion that the only way to "do it right" is to get the credentials in 
the signal handler. Everything else is racy.

THE PROBLEM

When I get the term signal, I would need to wait for the event to be logged to 
disk. So that means I have to inspect each packet and wait until the shutdown 
message comes through. But what if the backlog was full when that event would 
have been enqueued? 

Also, suppose I have a time out. When the timeout occurs, I have 2 choices: 
set the audit pid to 0 and then close the socket, or just close the socket. 
If I just close the socket, I get this message in the logs: 

Apr 11 16:55:04 localhost kernel: audit: *NO* daemon at audit_pid=15734

This looks ugly. But if I set the pid to 0, we don't get that message in the 
logs. But I am using the ack flag for positive confirmation of all netlink 
communication. So what if the signal event is the first thing I read from the 
socket instead of the ack? Meaning the event was delivered just after the 
timeout and before the logging thread finished?

Besides, by using a timeout, we do not meet the requirements. If the timeout 
occurs and we go ahead and shutdown, we simply don't have the information 
about who initiated the shutdown.

I can come up with more scenarios that show we can't meet the CAPP 
requirements by having an event placed into the message queue. The only way 
to guarantee that we meet requirements is for the credentials to be available 
*with* the signal delivery.

ALTERNATIVES

What I believe we should do is one of 2 things. Either create a SA_AUDITINFO 
structure that can be delivered with the signal - or to swap the values of 2 
entries in the siginfo_t structure. Between the two, I think SA_AUDITINFO is 
the correct way to do it. But I would like to examine swapping values first.

We need to think about LSPP as we do this and solve both problems while we are 
in this area. LSPP will require that we log the credentials of the initiator. 
This would be the SE Linux sid. It is kept in kernel as a u32 data type. The 
user id is kept as uid_t. So, we need to find 2 elements in the siginfo_t 
structure that we can replace with our data.

The si_uid fits the loginuid perfectly. The si_uid normally indicates the user 
that sent the signal. Since the audit daemon runs as root, only root 
processes can send signals to it. So basically, every time we get a signal, 
this element will be root which is meaningless. We can replace it with the 
loginuid and now it has meaning.

The SE Linux uid is tougher to fit. Because linux is deployed on 16 bit 
platforms, we cannot use any int in the siginfo_t structure and be correct. 
We have to find something that is a long. In include/asm-generic/siginfo.h, 
we can see the structure. A quick grep for long finds this:

#ifndef __ARCH_SI_BAND_T
#define __ARCH_SI_BAND_T long
#endif

We do not use poll in the audit daemon, so this might be a good candidate. 
Another candidate would be anything with clock_t. Looking at the per arch 
definition, they all seem to be long. So this means si_stime or si_utime  
have the right sizes.

The only issue left is choosing which one we want to use and agreeing on that. 
Since long is signed and the SE Linux sid is u32, we need to take care to 
load it correctly so we don't get sign extension. It needs to be cast to 
unsigned long and then long.

The other way of delivering credential with the signal is to create a new 
SA_AUDITINFO flag and a new structure to hold our information:

typedef struct sigauditinfo {
          int      sa_signo;  /* Signal number */
          int      sa_errno;  /* An errno value */
          int      sa_code;   /* Signal code */
          pid_t    sa_pid;    /* Sending process ID */
          sid       sa_pidsid;  /* Sending process sid */
          uid_t    sa_uid;    /* Real user ID of sending process */
          sid       sa_uidsid;  /* Real user's  sid */
          uid_t    sa_luid;    /* Login user ID of sending process */
           int      si_status; /* Exit value or signal */
} sigauditinfo_t;

This structure could be added to a union to ensure that it is the same size as 
siginfo_t. This will keep the stack unwinders happy. The above structure 
could be expanded to also include:

          clock_t  si_utime;  /* User time consumed */
          clock_t  si_stime;  /* System time consumed */
          sigval_t si_value;  /* Signal value */
          int      si_int;    /* POSIX.1b signal */
          void *   si_ptr;    /* POSIX.1b signal */
          void *   si_addr;   /* Memory location which caused fault */
          int      si_band;   /* Band event */
          int      si_fd;     /* File descriptor */

But if we do that, we are too big to be in a union without increasing the 
overall size. We could overcome this problem by using si_addr to point to a 
new structure whenever there's no address fault. That address would be valid 
only until the signal handler returns or is longjmp'ed out of.

NEXT STEP

The next step is to decide which way is cleanest and acceptable by upstream 
developers. Are there holes in either way proposed above? Can sending an 
shutdown audit event via netlink be done without races?

-Steve